CVE-2015-4050: Medium severity symfony vulnerability
CVE-2015-4050: ESI unauthorized access
Other sources
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /fragment.
FragmentListener in the HttpKernel component in Symfony 2.3.19 through 2.3.28, 2.4.9 through 2.4.10, 2.5.4 through 2.5.11, and 2.6.0 through 2.6.7, when ESI or SSI support enabled, does not check if the controller attribute is set, which allows remote attackers to bypass URL signing and security rules by including (1) no hash or (2) an invalid hash in a request to /fragment.
This issue has been fixed in Symfony 2.3.29, 2.5.12, and 2.6.8. Note that no fixes are provided for Symfony 2.4 as it's not maintained anymore.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4050?
CVE-2015-4050 has a medium severity level as it allows unauthorized access to some fragments when ESI or SSI support is enabled.
How do I fix CVE-2015-4050?
To fix CVE-2015-4050, upgrade to Symfony versions 2.3.29, 2.5.12, 2.6.8 or later.
What software is affected by CVE-2015-4050?
CVE-2015-4050 affects Symfony versions from 2.3.19 to 2.6.7, specifically 2.3.x, 2.4.x, 2.5.x, and 2.6.x series.
Can CVE-2015-4050 lead to remote code execution?
CVE-2015-4050 could potentially allow remote attackers to execute unauthorized code under certain configurations.
Is CVE-2015-4050 related to web application firewalls?
While CVE-2015-4050 does not directly involve web application firewalls, implementing such a firewall can help mitigate its impact.